Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes
| От | Dave Page |
|---|---|
| Тема | Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes |
| Дата | |
| Msg-id | CA+OCxozF-WX_y2cPuf9g8X9V=RFU1r6mciam+8uTK1VgVG9NnA@mail.gmail.com обсуждение исходный текст |
| Ответ на | Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes (Dave Page <dpage@pgadmin.org>) |
| Ответы |
Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes
|
| Список | pgadmin-hackers |
BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's obviously of interest to users.
Thanks.
On Wed, May 10, 2017 at 9:06 AM, Dave Page <dpage@pgadmin.org> wrote:
On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote: On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage@pgadmin.org> wrote:On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote: Thanks.Committed!I agree with the change from a preventative/safety perspective, though I'm struggling to classify it as a security issue, given that collections are always named by the code and not from user input.Am I missing something?True - but not the case with the server-group.It is a collection node, still has it's own label.Ahh, yes.--Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
В списке pgadmin-hackers по дате отправления: